Privacy Policy

1. Data Controller and Ghana Data Protection Act 2012 (Act 843)

BedWatch Africa is an initiative of Babykaafo. BedWatch Africa is operated by Babykaafo and BedWatch Africa Limited, together referred to as "BedWatch Africa", "we" or "us", and they act as the data controller under the Ghana Data Protection Act 2012 (Act 843).

Our principal office is at 49 Salem Road, Osu, Accra, Ghana.

Data Protection Commission registration status: Data Controller registration with the Ghana Data Protection Commission (Act 843) is pending. This policy will be updated with the registration number as soon as it is issued — we will never display a registration number before the Commission has actually issued one.

2. Data We Collect

A. Data you provide:

• Phone number (required for all accounts)
• Full name
• Email address (optional for Ghana subscribers, required for visitor accounts)
• Nationality and country of residence (visitor accounts)
• Passport number (optional, visitor accounts only, encrypted)
• Travel insurance provider and policy number (optional, visitor accounts)
• Blood type (optional, for emergency information)
• Known allergies (optional, for emergency information)
• Trusted contact names and phone numbers — these are personal data about someone other than you; by adding a contact you confirm you have their permission to share it with us for emergency-alert purposes
• Ghana arrival and departure dates (visitor accounts)
• Family plan member details — a family plan may include dependants, including minors; the plan holder is responsible for the accuracy of any dependant information added

B. Data collected automatically:

• GPS location (only when you use the emergency routing feature — not stored continuously)
• Emergency flag data (GPS coordinates at time of emergency trigger, hospital selected, time)
• Subscription and payment data (card/mobile money details are held by Paystack, our payment processor, not by BedWatch Africa directly — we only store the payment reference, amount, and status)
• Platform usage logs for security and abuse prevention
• Device fingerprint and IP address, for anonymous public emergency reports only — used solely to detect and limit spam/abusive report bursts, never to identify you

C. Data from facilities:

• Ward and bed status data entered by facility staff
• Emergency acknowledgement data when a facility confirms receipt of an emergency alert

3. How We Use Your Data

• To provide the emergency routing and hospital notification service
• To send SMS, WhatsApp, or Telegram alerts to your trusted contacts when you trigger an emergency
• To process your subscription payment
• To generate international insurance documentation when requested
• To send subscription reminders and platform updates
• To improve the platform and fix bugs, including by sending de-identified technical context to our AI service providers when diagnosing an issue
• To aggregate anonymised data for health intelligence dashboards accessed by government and research partners
• To comply with legal obligations

We do NOT sell your personal data to third parties. We do NOT use your data for advertising. BedWatch Africa products are ad-free.

4. Who We Share Data With (Sub-Processors)

We share data only with the service providers below, each only for the purpose stated, and with the health facility you are routed to or your trusted contacts during an emergency. We do not sell data and do not share it for any provider's own marketing purposes.

• Supabase (database, authentication, file storage) — hosted in the EU (Ireland). Receives nearly all account and emergency data described above.
• Vercel (application hosting) — functions run in the EU (Dublin). Receives request data needed to serve the app.
• Paystack (payments, Ghana) — receives phone, email, and payment amount for all plans, including visitor plans priced in USD (visitor charges are processed in Ghanaian Cedis — see the Refund and Cancellation Policy). Card and mobile money details are held by Paystack, never by us.
• Hubtel (SMS/WhatsApp/USSD, Ghana) — receives phone numbers and message content (OTP codes, emergency alerts) for Ghanaian numbers.
• Africa's Talking (SMS fallback, non-Ghana Africa) — receives phone numbers and message content when Hubtel cannot deliver.
• Telegram (login codes for subscribers with a non-Ghana phone number) — receives your Telegram user ID and a one-time login code.
• Resend (transactional email, US-based) — receives your email address and message content for account and BERF-related emails.
• Mapbox and Google Maps (map display and address lookup, US-based) — receive coarse location data to render maps and, on facility registration, an address you type in to look up coordinates.
• Anthropic (Claude) — receives facility capacity data, and in some features voice transcripts or clinical-adjacent text, to power surge detection, outbreak alerts, and AI-assisted documentation.
• Google Cloud Vertex AI / MedGemma — receives clinical documentation text and voice transcripts for AI-assisted medical documentation features. This is health data, sent only for this specific purpose.
• Government health agencies and research partners — anonymised, aggregated intelligence data only; no individual identification.
• When required by Ghanaian law or valid legal process.

5. International Data Transfers

Several of the service providers listed above are located outside Ghana — principally in the European Union/Ireland (Supabase, Vercel) and the United States (Resend, Mapbox, Google, Anthropic). This means your personal data, including health-adjacent and location data, is regularly transferred outside Ghana.

We select providers that maintain their own appropriate security and data protection standards, and we work with them under their standard data processing terms. We have not independently verified that a Ghana-specific transfer mechanism (such as Standard Contractual Clauses naming BedWatch Africa/Babykaafo) is separately executed with each provider beyond their standard terms — this is flagged for legal review rather than represented as complete.

6. Data Retention

• Active subscription data: retained for the duration of your subscription plus 12 months
• Emergency flag and incident records: retained for safety and audit purposes; some incident records are legally append-only and cannot be deleted even on request (see Section 8)
• Passport data: retained for 12 months after subscription end for insurance claim purposes, then permanently deleted
• Payment records: retained for 7 years as required by Ghanaian tax law
• Anonymised usage and health intelligence data: retained indefinitely in aggregated form

7. Data Security

• All data is encrypted in transit using TLS 1.2 or higher
• Passport data is encrypted at rest using AES-256 encryption
• Access to personal data is restricted to authorised staff on a need-to-know basis
• We choose service providers that maintain their own security and data protection standards, and we limit the data each provider receives to what its purpose requires.

8. Your Rights Under the Ghana Data Protection Act 2012 (Act 843)

As a data subject under Act 843, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements — see Section 6)
• Object to specific processing
• Data portability (receive your data in a machine-readable format)
• Withdraw consent where consent is the legal basis for processing
• Lodge a complaint with the Ghana Data Protection Commission once our registration is complete

You can delete your own account and data in-app (where legally possible), or submit a request without logging in, at legal@bedwatchafrica.com or via our deletion request page. We respond within 14 days.

9. GDPR and UK GDPR (EU and UK-Based Visitors)

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR also apply to our processing of your data, in addition to Act 843. Your rights are materially the same as under Section 8: access, rectification, erasure, data portability, objection, and withdrawal of consent.

Legal basis for processing: contract performance (to provide the service you signed up for), legitimate interests (platform security and abuse prevention), and consent (for optional data such as passport details).

You also have the right to lodge a complaint with your national data protection supervisory authority (for UK residents, the Information Commissioner's Office).

See the Visitor and Diaspora Terms for additional detail on international data transfers affecting EU/UK visitors.

10. Cookies and Tracking

BedWatch Africa uses only essential cookies necessary for platform functionality and session management. We do not use advertising cookies, tracking pixels, or third-party analytics that identify individuals. Visitors from the EU/UK see a cookie notice on first visit, consistent with the essential-only cookie use described here.

11. Contact and Complaints

To exercise any of the rights above, contact us at legal@bedwatchafrica.com. We will respond within 14 days.